#446 Telemetry ingest only resolves personal API keys — collective-token events are unattributed, identity_map under-claims

Summary

The telemetry ingest only resolves personal API keys to a username, so events authenticated with a collective/org token (swamp_org_…) arrive unattributed. As a result identity_map (username → distinct_ids) never claims those distinct_ids, and the users are mis-bucketed as anonymous / "no account".

Impact

• "Users without an account" and active-user metrics are inflated (upper bound, not truth).
• Per-user attribution and leaderboard linkage undercount real authenticated operators.
• Systemic — affects any collective-scoped CLI usage, not an edge case.

Evidence (provable)

extension push is auth-gated; you cannot publish without authenticating. Yet 26 distinct_ids that ran extension push are absent from identity_map (query user_metrics for event_counts.cli_invocation.commands.extension.subcommands.push > 0, subtract the union of identity_map.distinct_ids). Publishing proves authentication, so their "unauthed" classification is impossible.

Root cause (server side)

1. identity_map only gains a distinct_id when event.username is set — services/telemetry/lib/consumers/stats.ts:282 (if (!event.username) continue).
2. Ingest resolves username via verifyApiKey only — services/telemetry/main.ts:126 → shared/auth/api_key.ts, which checks the personal apikey collection. A verifyCollectiveApiKey (collective_apikey → slug, no username) exists but ingest never calls it.
3. So a swamp_org_… token sent as the telemetry x-api-key returns null → event.username unset → distinct_id never claimed.

Suggested fix

• Ingest should also attempt the collective resolver and attribute the event (at minimum to the collective; ideally to the acting member).
• Backfill existing identity_map from extension_versions (publisher is known) and the S3 event archive (correlate the CLI push event's distinct_id with the server extension_published event's username by extension + timestamp).

Related

Sibling CLI-side defect filed against swamp (the CLI forwards a non-personally-resolvable identity for collective auth) — cross-linked below.